When deployed in proxy mode, by default the Barracuda Web Application Firewall appears as the source IP address in the requests it forwards to the back-end servers. For servers on the back-end needing to access the actual client IP address, the Barracuda Web Application Firewall provides two configurable ways to achieve this:
- Client Impersonation
- X-Forwarded-For Header
While both of these options provide the Client IP address to the servers, you should consider the following before deciding which option to use:
|Client Impersonation||X-Forwarded-For Header|
Provides the Client IP address in the Source IP address of the request.
Requires a networking change.
Provides the Client IP address in the Header "X-Forwarded-For" of the Request.
Requires a logging change.
To Use the Client IP address from the X-Forwarded-For Header
By default, the Client IP Address is inserted by the Barracuda Web Application Firewall in the request Header "X-Forwarded-For" when the request is forwarded to the back-end server.
To use the embedded IP Address with Apache servers or with IIS 7 or IIS 7.5 servers, refer to the following articles:
- Logging Actual Client IP Address on the Apache Server
- Logging Actual Client IP Address In the IIS 7 and IIS 7.5 Server
How to Log Client IP Address when the Barracuda Web Application Firewall is Deployed Behind a Proxy
If the Barracuda Web Application Firewall is deployed behind a Proxy server, all requests have their client IP address as the address of the Proxy server, which is logged as the Client IP on the BASIC > Access Logs page. To log the actual client IP address, specify the header name appended by the Proxy server which contains the actual client IP address in the Header for Client IP Address field on the BASIC > Services page.
Steps To Configure the Header Name:
- Edit the Service from the BASIC > Services page.
- Scroll down to the Basic Security section and specify the header name in the Header for Client IP Address field. The standard headers used to store the actual client IP address are:
- Specify values for other fields as required and click Save. For more information on how to edit a Service, see Step 3: Configuring Basic Service Settings.
When a request is received, the Barracuda Web Application Firewall gets the actual client IP address from the specified header and displays it in the Client IP field of the Access Logs.
For example, consider the client IP addresses 126.96.36.199 and 188.8.131.52, and proxy IP address 184.108.40.206. When the client sends a request, the proxy receives the request and stores the IP address of the client in the X-Forwarded-For or X-Client-IP header, and forwards the request to the Barracuda Web Application Firewall. The Barracuda Web Application Firewall extracts the client IP address from the specified header and displays it in the Access Logs.